HCISPP Online Training Archives

Exam4Training can provide a shortcut for you and save you a lot of time and effort. Exam4Training will provide good ISC2 HCISPP HealthCare Information Security and Privacy Practitioner Online Training for your ISC2 certification HCISPP exam and help you pass HCISPP HealthCare Information Security and Privacy Practitioner exam. If you see other websites provide relevant information to the website, you can continue to look down and you will find that in fact the information is mainly derived from our Exam4Training. Our Exam4Training provide the most comprehensive information and update fastest.

Page 1 of 10

1. Which of the following is the BEST reason for writing an information security policy?

To support information security governance

To reduce the number of audit findings

To deter attackers

To implement effective information security controls

2. When assessing an organization’s security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?

Only when assets are clearly defined

Only when standards are defined

Only when controls are put in place

Only procedures are defined

3. Provides assistance, advice and information to the patient.

Coder

Consultant

Medical Transcriptionist

4. Clients need to receive a copy of Notice of Privacy Practices.

True

False

5. A health plan may conduct its covered transactions through a clearinghouse, and may require a provider to conduct covered transactions with it through a clearinghouse. The incremental cost of doing so must be borne

by the HIPPA authorities

by the health plan

by any other entity but the health plan

by insurance companies

6. Was known for identifying anthrax.

Robert Koch

Edward Jenner

Louis Pasteur

7. Helps people with low incomes get the necessary medical help or need. Varies from state to state.

Medicare

Medicaid

Chips

8. Children under age 18 comprise approximately, what percentage of the homeless population?

40%

30%

35%

45%

9. True or False? Globalization of health care has produced positive effects in both developed and developing countries.

True

False

10. Which of the following actions will reduce risk to a laptop before traveling to a high risk area?

Examine the device for physical tampering

Implement more stringent baseline configurations

Purge or re-image the hard disk drive

Change access codes

Page 2 of 10

11. A Governing board is also known as the___________.

Medical Staff

Administration

Board of Trustees

12. Excessive health care is a concern because it is.

Wasteful

Costly

Potentially harmful

All of the above

13. True or false: For people with Medicaid coverage, access to health care is guaranteed.

True

False

14. What data-related concept identifies or characterizes entities and events in a manner that facilitates an administrative process?

Non-medical or Administrative Code Sets

Data Mapping

Medical or Clinical Code Sets

Data Elements

15. Which is not a "painless" cost control strategy?

Reduction of administrative waste

Use of cost-effective analysis to limit care

Elimination of inappropriate care

Elimination of ineffective care

16. For most privately insured Americans, health insurance is:

Employer-based

Financed by the government

Privately purchased

None of the above

17. Flemming discovered The Cannon of Medicine.

True

False

18. What mandates all privacy in hospital administration?

HIPPA

JCAH

Medicare

19. Which of the following is the MOST significant benefit to implementing a third-party federated identity architecture?

Attribute assertions as agencies can request a larger set of attributes to fulfill service delivery

Data decrease related to storing personal information

Reduction in operational costs to the agency

Enable business objectives so departments can focus on mission rather than the business of identity management

20. What type of hospital is an Government Hospital?

For Profit

Not For Profit

Page 3 of 10

21. Jackson broke his ankle while performing with his band 100 Monkeys. Jackson was rushed to the E.R and from there he was referred to a bone specialist.

What type of care is Jackson in?

Quaternary

Primary

Secondary

22. The Hippocratic Oath was in the Medieval time period.

True

False

23. The adequacy of the health profession workforce (ie. supply and demand) can be determined by.

Market demand of health professions

Population need of health professions

Neither A nor B are determinants

Both A and B are determinants

24. They create and vote on bylaws

Medical Staff

Administration

Governing Board

25. Surgeons usually receive a single payment for the surgery and postoperative care. This bundling, or payment per episode, gives surgeons an economic incentive to.

Limit both the number of surgeries they perform and the number of post operative visits they make.

Increase both the number of surgeries and the number of post operative visits.

Limit the number of surgeries and increase the number of post operative visits.

Increase the number of surgeries and limit the number of post operative visits.

26. What is impact of the HITECH Act in relation to HIPAA requirements and maintaining client records electronically?

There is a push toward paper records to prevent the hacking and electronic violation of electronic records, which is easily done without detection

Providers must now maintain client records electronically, but may continue to provide clients a paper copy when access is requested

There is no requirement to maintain client records electronically, but clients have the right to insist on electronic access to an electronic health record, if it exists

Electronic records now face intensified scrutiny, requiring practitioners to implement more sophisticated software and detailed accounting of records Your

27. Business Associate Agreements are required by the regulation whenever a business associate relationship exists. This is true even when the business associates are both covered entities.

There are no specific elements which must be included in a Business Associate Agreement. However some recommended but not compulsory elements are listed in 164.504(e) (2)

There are specific elements which must be included in a Business Associate Agreement. These elements are listed Privacy Legislation

There are no specific elements which must be included in a Business Associate Agreement.

There are specific elements which must be included in a Business Associate Agreement. These elements are listed in 164.504(e) (2)

28. What does the federal Ryan White CARE Act fund?

Care for underserved rural and urban populations

Skin cancer screening programs

School-based health services in predominantly minority neighborhoods

Development of treatment and care options for persons with HIV and AIDS

29. Who believed that the only was to understand a disease was to examine the cells of the affected body?

Lister

Flemming

Koch

Virchow

30. ___________ is one of the main objectives of HIPAA.

Secrecy

Accountability

Anonymity

Complexity

Page 4 of 10

31. Private health insurance coverage has decreased over the past decades because of.

The rising cost of health care.

An increase in non-unionized jobs

A shift from manufacturing jobs to service industry jobs

All of the above

32. The CQI approach of producing health care "report cards," specifically HEDIS is a tool to encourage health care consumers to choose high-quality caregivers, but often.

these report cards are inaccurate

cost, not quality is the driving motivator for employers to choose health care plans for their employees

HEDIS includes only a limited number of quality performance indicators

None of the above

33. Substance abuse regulations do not allow disclosure with a subpoena unless a court has issued an order following a show cause hearing.

True

False

34. Marcus is responsible for security management within a HIPAA-covered entity. He is reviewing administrative safeguards and examining the organization's risk analysis.

Which element is NOT part of risk analysis?

Developing adequate communication with all contractors, interns, and staff in relation to the agency's security policies

Assessing vulnerabilities of integrity and availability of electronic personal health information

Determining how client electronic personal health information confidentiality may be compromised

Determining barriers in existence to needed client electronic personal health information

35. Courtesy allows doctors to admit an occasional patient to the hospital.

True

False

36. They examine cost of claims to determine whether it is a reasonable or necessary, according to diagnosis.

Coders

Billers

Health Insurance Specialist

37. Critics of the United States health care system find fault with all of the following EXCEPT:

its lack of organizational coherence

its tertiary care organization

its over reliance on primary care

its specialist orientation

38. HIPAA guidelines say employers that sponsor employee group health plans must maintain privacy of which __________________ in secured locations, if kept in the office?

Information related to lawsuits again employers

Enrollment and claim information

Workman's Compensation claims

Deidentified information

39. What is a Covered Entity? The term "Covered Entity" is defined in 160.103 of the regulation.

The definition is complicate and long.

The definition is referred to in the Secure Computing Act

The definition is very detailed.

The definition is deceptively simple and short

40. Acts on reports and recommendations from medical staff committees.

Joint

Credentials

Ethics

Executive

Page 5 of 10

41. This type of hospital is privately owned.

For Profit

Not for Profit

42. What was the function of a pest house in the preindustrial period?

To house people who had a contagious disease.

To provide refuge to those who were threatened by pests.

To eradicate pests.

To treat contagious diseases.

43. Which racial/ethnic group is growing the fastest?

White

Black or African American

Asian or Pacific Islander

Hispanic

44. If you go and get a physical exam.

What type of care did you just receive?

Primary

Secondary

Tertiary

Quanternary

45. Which one of these risk factors would be the LEAST important consideration in choosing a building site for a new computer facility?

Vulnerability to crime

Adjacent buildings and businesses

Proximity to an airline flight path

Vulnerability to natural disasters

46. Confidentiality means that data is not to be made available to unauthorized persons.

True

False

47. The Flexner Report, published in 1910, reported on.

Disease trends

Standards of training in medical schools

Rates of deaths in

hospitals

The state of medical specialization

48. Part of Administrative Safeguards under HIPAA is Workforce Security measures.

Which is NOT a key element of a Workforce Security Element?

Identification of barriers to client electronic Personal Health Information

Clearance Procedures

Termination Procedures

Authorization and Supervision

49. Regulatory strategies for health insurance financing seek to control public expenditures for health care by.

Implementing tax-financed health insurance or limiting premiums

Limiting the annual use of services among patients

Increasing competition among health insurance plans

Only A and C

50. Breach notification exceptions are provided to all, EXCEPT:

Business associates who access information by good faith, unintentional means and do not further disclose information

Unintentional, good faith access by employees of covered entities if the information was not further disclosed

If the information impacted less than 500 people within a single demographic area

Inadvertent disclosure made individual to individual within a covered entity who is authorized to access protected health information

Page 6 of 10

51. Which is NOT consistent with Personnel Clearance Procedures needed to comply with HIPAA Administrative Safeguards?

Current database of what personnel has access to buildings, offices, filing cabinets, computers, and databases

New employees, contractors, and unpaid staff have references checked

Appropriate exit interviews for outgoing personnel

Discretion given to who does and does not have access to secure office spaces or keys/door codes

52. The HIPPA task force must first

inventory the organization's systems, processes, policies, procedures and data to determine which elements are critical to patient care and central to the organization's business

inventory the organization's systems, processes, policies, procedures and data to determine which elements are non critical to patient care and central to the organization's business

inventory the organization's systems, processes, policies, procedures and data to determine which elements are critical to patient complaints and central to the organization's peripheral businesses

modify the organization's systems, processes, policies, procedures and data to determine which elements are critical to patient care and central to the organization's business

53. Which is NOT one of the three major categories of Security Safeguards identified by HIPAA in the regulations?

Administrative

Professional

Physical

Technical

54. The criminal penalties for improperly disclosing patient health information can be as high as fines of $250,000 and prison sentences of up to 10 years.

True

False

55. What is the primary purpose of the National Health Service Corps?

To recruit physicians to provide services in physician shortage areas in the

To recruit physicians from abroad to work in the United States

To send

physicians to developing countries to provide services to the indigent

To recruit physicians into the military

56. This hospital is owned by corporations and makes up 15% of hospitals in the United States.

Government

Volunteer

Teaching

Proprietary

57. Which one of the following is NOT a fundamental component of a Regulatory Security Policy?

What is to be done.

When it is to be done.

Who is to do it.

Why is it to be done

58. Approximately how many Americans are uninsured?

16 million

26 million

46 million

66 million

59. What is the meaning of the term 'Access'?

All citizens have health insurance coverage

Ability to get health care when needed

Availability of services

Employer-based health insurance

60. Which of the following information is generally considered confidential?

Demographics

Diagnosis

Billing Information

Dates of Service

All of the Above

Page 7 of 10

61. A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding.

Which of the following BEST supports this recommendation?

The inherent risk is greater than the residual risk.

The Annualized Loss Expectancy (ALE) approaches zero.

The expected loss from the risk exceeds mitigation costs.

The infrastructure budget can easily cover the upgrade costs.

62. Assembly and analysis of a discharged patients record chart.

Record Circulation

Incomplete Record Porcessing

63. Copies of patient information may be disposed of in any garbage can in the facility.

True

False

64. He discovered X-Rays.

Lister

Flemming

Koch

Roentgen

65. Is an interpretation of a law that is written by the responsible regulatory agency.

Joint Conference

Regulations

Licenses

66. Which of the following is a potential risk when a program runs in privileged mode?

It may serve to create unnecessary code complexity

It may not enforce job separation duties

It may create unnecessary application hardening

It may allow malicious code to be inserted

67. A covered healthcare provider which a direct treatment relationship with an individual need not:

provide the notice no later than the date of the first service delivery, including service delivered electronically

have the notice available at the service delivery site for individuals to request and keep

get a acknowledgement of the notice from each individual on stamped paper

post the notice in a clear and prominent location where it is reasonable to expect individuals seeking service from the covered healthcare provider to be able to read it

68. A medical intervention lying on a steeper portion of the aggregate cost-benefit curve indicates a major benefit for a relatively modest cost.

An example of such an intervention would be:

childhood immunizations.

lung transplants.

care for an anencephalic infant.

purchasing MRI scanners to supplement CT scanners.

69. The management of a rare and complex disorder such as pituitary tumors would be considered an example of.

Primary care

Secondary care

Tertiary care

Both A and B

70. The inception of _____ was used as a trial balloon for the idea of government-sponsored universal health insurance.

workers' compensation

trade unions

public health

health care for the veterans

Page 8 of 10

71. Is a list of all items of business to be discussed.

Minutes

Agenda

72. Which is not an underlying assumption of a theoretical model of costs and health outcomes?

The relevant outcome is the overall health of a population rather than of an individual.

It is possible to quantify health at a population level.

It is necessary to focus on health outcomes, those aspects of health status directly under the influence of health care.

It is impossible to reduce cost without also reducing health outcomes.

73. The confidentiality of alcohol and drug abuse patient records maintained by this program is protected by federal law and regulations. Generally, the program may not say to a person outside the program that a patient attends the program, or disclose any information identifying a patient as an alcohol or drug abuser even if:

The person outside the program gives a written request for the information

the patient consent in writing

the disclosure is allowed by a court order

the disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation.

74. You always abide by the HIPAA privacy rule.

True

False

75. In a free market who would pay for the delivery of health care services?

numerous health insurance companies

patients

government

multiple payers

76. A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning (BCP).

Which of the following failures should the IT manager be concerned with?

Application

Storage

Power

Network

77. Health Information Rights although your health record is the physical property of the healthcare practitioner or facility that compiled it, the information belongs to you.

You do not have the right to:

obtain a paper copy of the notice of information practices upon request inspect and obtain a copy of your health record as provided for in 45 CFR 164.524

request a restriction on certain uses and disclosures of your information outside the terms as provided by 45 CFR 164.522

amend your health record as provided in 45 CFR 164.528 obtain an accounting of disclosures of your health information as provided in 45 CFR 164.528

revoke your authorization to use or disclose health information except to the extent that action has already been taken

78. Covered entities (certain health care providers, health plans, and health care clearinghouses) are not required to comply with the HIPPA Privacy Rule until the compliance date.

Covered entities may, of course, decide to:

unvoluntarily protect patient health information before this date

voluntarily protect patient health information before this date

after taking permission, voluntarily protect patient health information before this date

compulsorily protect patient health information before this date

79. Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider’s customers?

Security

Privacy

Access

Availability

80. Which of the following is an overarching goal of Healthy People 2010?

Decrease health care costs

Create a more coordinated health care system

Establish a national health insurance program

Increase quality and years of healthy life

Page 9 of 10

81. Which of the following are some common features designed to protect confidentiality of health information contained in patient medical records?

Locks on medical records rooms

Passwords to access computerized records

Rules that prohibit employees from looking at records unless they have a need to know

All of the above

82. The role of the government in the U.S. healthcare system is:

Regulator

Major financer

Medicare and Medicaid reimbursement rate-setter

All of the above

83. DRAG DROP

Place in order, from BEST (1) to WORST (4), the following methods to reduce the risk of data remanence on magnetic media.

84. The First Blue Cross plan was given to teachers at Baylor University allowing them 21 days of hospital care at six dollars a year.

True

False

85. A multiple payer system is more cumbersome than a single payer system for all of the following reasons except:

There are numerous health plans, which is difficult for providers to handle

Payments are not standardized across health plans

Some healthcare services are covered for people in the north, but not in the south

Government programs required extensive documentation proving services were provided before paying providers

86. Are there penalties under HIPPA?

No penalties

HIPPA calls for severe civil and criminal penalties for noncompliance, including: -- fines up to $25k for multiple violations of the same standard in a calendar year -- fines up to $250k and/or imprisonment up to 10 years for knowing misuse of individually identifiable health information.

HIPPA calls for severe civil and criminal penalties for noncompliance, includes: -- fines up to 50k for multiple violations of the same standard in a calendar year -- fines up to $500k and/or imprisonment up to 10 years for knowing misuse of individually identifiable health information

HIPPA calls for severe civil and criminal penalties for noncompliance, including: -- fines up to $100 for multiple violations of the same standard in a calendar year -- fines up to $750k and/or imprisonment up to 20 years for knowing misuse of individually identifiable health information

87. Handled the first bioterrorism attack in the mail. Also replaced Health Care Financing Administration.

Joint Commission

CMS

HIPPA

88. Business Associates

are entities that perform services that require the use of Protected Health Information on behalf of Covered Entities. One covered entity may be a business partner of another covered entity

are entities that do not perform services that require the use of Protected Health Information on behalf of Covered Entities. One covered entity may be a business partner of another covered entity

are entities that perform services that require the use of Encrypted Insurance Information on behalf of Covered Entities. One covered entity may be a business partner of another covered entity

are entities that perform services that require the use of Protected Health Information on behalf of Covered Entities. One covered entity cannot be a business partner of another covered entity.

89. If a state or federal law or regulation grants the client greater access to their PHI, then it will preempt HIPAA.

True

False

90. You are approached by an individual who tells you that he is here to work on the computers and wants you to open a door for him or point the way to a workstation.

How do you respond to this request?

Provide him with the information or access he needs.

Ask him who at the facility has hired him and refer him to that person for assistance.

Call the police.

Page 10 of 10

91. The primary objectives of a healthcare system include all of the following except:

Enabling all citizens to receive healthcare services

Delivering healthcare services that are cost-effective

Delivering healthcare services using the most current technology, regardless of cost

Delivering healthcare services that meet established standards of quality

92. Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?

Executive audiences will understand the outcomes of testing and most appropriate next steps for corrective actions to be taken

Technical teams will understand the testing objectives, testing strategies applied, and business risk associated with each vulnerability

Management teams will understand the testing objectives and reputational risk to the organization

Technical and management teams will better understand the testing objectives, results of each test phase, and potential impact levels

93. Hospitals in the United States evolved from

alms houses

sick homes

pest houses

inns

94. Which of the following forces remains relatively stable, and major shifts in this area would be necessary to bring about any fundamental change in the US health care delivery system?

Economic forces

Political change

Beliefs and values

Social forces

95. DRAG DROP

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

Below are the common phases to creating a Business Continuity/Disaster Recovery (BC/DR) plan. Drag the remaining BCDR phases to the appropriate corresponding location.

96. Which racial/ethnic group has the highest rate of uninsurance?

White

Hispanic

Asian or pacific islander

Black or African American

97. Believed that germs caused death and founded aseptic surgery.

Lister

Koch

Flemming

98. A continuous information security monitoring program can BEST reduce risk through which of the following?

Collecting security events and correlating them to identify anomalies

Facilitating system-wide visibility into the activities of critical user accounts

Encompassing people, process, and technology

Logging both scheduled and unscheduled system changes

99. The intent of patient cost sharing at the point of receiving health care services is to.

Discourage the overuse of services among patients.

Discourage physicians from overcharging patients.

Encourage patients to utilize more health care services.

Encourage physicians to provide more effective health care services.

100. Who monitors the purity of foods and safety of medicines?

Joint Commission

CMS

Medicare

FDA